When generative AI reached the mainstream in 2022, most companies started thinking about AI governance for the first time. TELUS had already been building its programme for three years. The framework it had in place let the company adopt AI quickly  while meeting the kinds of standards regulators were only beginning to draft.

The dilemma

When large language models became widely available to the public in late 2022, companies faced a difficult trade-off. Adopting the new technology quickly could deliver competitive advantage, but doing so without proper governance created risks around privacy, bias, misinformation, and regulatory exposure. Waiting for governance frameworks to catch up meant falling behind competitors. In sectors like telecommunications and healthcare, where AI would touch sensitive customer data and clinical decisions, getting this wrong could damage trust in ways that would take years to repair.

The regulatory gap

At the time, there was no comprehensive AI-specific regulation in Canada or most other jurisdictions where TELUS operates. Existing privacy laws covered some of the ground, but did not address AI-specific questions like how to test a model for bias, how to explain an AI decision to a customer, or how to keep a generative AI tool from producing false information. Companies deploying AI at scale had to either wait for regulators to catch up, or build their own governance systems in the meantime.

The approach

TELUS committed publicly to responsible AI in 2019, three years before generative AI reached mainstream use. The company already had an established  Data and Trust Office - staffed with privacy, data governance, and data ethics specialists, including an in-house Data Ethicist – guided by TELUS’ Trust Model. This model defines how data should be used to generate value, promote respect, and deliver security for stakeholders, and it underpins TELUS’ broader Data Principles.  Building on that foundation, TELUS developed a set of internal frameworks including an AI Policy approved by the board, a Responsible AI Framework, and model governance standards.

When generative AI arrived, TELUS was able to adapt these structures rather than build from scratch. It consolidated its responsible AI, privacy, and security reviews into a single integrated process, so that projects went through one review rather than three separate ones. It certified data stewards across business units to embed governance in the day-to-day work of teams outside the central office. And it used a practice it calls Purple Teaming, adversarial testing of AI systems by diverse cross-functional teams, to catch problems that a single expert group might miss.

Results achieved

In October 2023, TELUS became the first company in the world to receive the ISO 31700-1 Privacy by Design certification, awarded for its Data for Good programme. In May 2024, its generative AI customer support tool, powered by the Fuel iX platform, became the first in the world to receive the same ISO 31700-1 certification for a GenAI product. Both certifications were evaluated by KPMG.

In 2025, TELUS became the first Canadian company to contribute to the G7 Hiroshima AI Process Transparency Report, an international framework for AI transparency reporting hosted by the OECD. The company also became the first Canadian telecom to join the US AI Safety Consortium, part of the US National Institute of Standards and Technology's work on AI safety.

Two limits are worth noting. Much of what TELUS reports about the internal reach of its programme, including its adoption metrics and the business value it attributes to responsible AI, is drawn from the company's own accounts. Independent evaluation of whether the governance framework actually reduces harm to customers, or whether it materially outperforms other AI governance approaches, is not yet publicly available.

The transferable lesson

The most useful design choice TELUS made was to consolidate rather than fragment its governance reviews. Combining responsible AI, privacy, and security assessments into one integrated process meant teams could move quickly without skipping steps, and gave the company a single point of accountability for each AI project. The lesson for companies at earlier stages of AI adoption is that governance done as a series of separate approvals slows innovation and creates gaps between reviews, while governance built into a single integrated process can enable faster deployment. The lesson for regulators is complementary: mandates that focus on outcomes and evidence, rather than prescribing separate reviews for each type of risk, are easier for well-run companies to align with.